ASiC-S LTA extending support

IB-8182

Signed-off-by: Raul Metsma <raul@metsma.ee>

Author: metsma

examples/DigiDocCSharp/Program.cs

@@ -209,6 +209,11 @@ private static void Verify(string file)
                     Console.WriteLine("Time: " + s.trustedSigningTime());
                     Console.WriteLine("Cert: " + s.signingCertificate().Subject);
                     Console.WriteLine("TimeStamp: " + s.TimeStampCertificate().Subject);
+                    foreach (TSAInfo tsaInfo in s.ArchiveTimeStamps())
+                    {
+                        Console.WriteLine("Archive Time: " + tsaInfo.time);
+                        Console.WriteLine("Archive Cert: " + tsaInfo.cert.Subject);
+                    }
 
                     s.validate();
                     Console.WriteLine("Signature is valid");

examples/java/src/main/java/ee/ria/libdigidocpp/libdigidocpp.java

@@ -152,6 +152,10 @@ static void verify(String file) {
                 System.out.println("Time: " + signature.trustedSigningTime());
                 System.out.println("Cert: " + signature.signingCertificate().getSubjectDN().toString());
                 System.out.println("TimeStamp Cert: " + signature.TimeStampCertificate().getSubjectDN().toString());
+                for(TSAInfo tsaInfo : signature.ArchiveTimeStamps()) {
+                    System.out.println("Archive Time: " + tsaInfo.getTime());
+                    System.out.println("Archive Cert: " + tsaInfo.getCert().getSubjectDN().toString());
+                }
 
                 try
                 {

libdigidocpp.i

@@ -102,15 +102,17 @@ static std::vector<unsigned char>* SWIG_JavaArrayToVectorUnsignedChar(JNIEnv *je
 %{ $1 = SWIG_JavaArrayToVectorUnsignedChar(jenv, $input); %}
 %typemap(out, fragment="SWIG_VectorUnsignedCharToJavaArray") std::vector<unsigned char>, digidoc::X509Cert
 %{ $result = SWIG_VectorUnsignedCharToJavaArray(jenv, $1); %}
-%typemap(jtype) std::vector<unsigned char>, digidoc::X509Cert "byte[]"
+%typemap(out, fragment="SWIG_VectorUnsignedCharToJavaArray") digidoc::X509Cert *
+%{ $result = SWIG_VectorUnsignedCharToJavaArray(jenv, *$1); %}
+%typemap(jtype) std::vector<unsigned char>, digidoc::X509Cert, digidoc::X509Cert * "byte[]"
 %typemap(jstype) std::vector<unsigned char> "byte[]"
-%typemap(jstype) digidoc::X509Cert "java.security.cert.X509Certificate"
-%typemap(jni) std::vector<unsigned char>, digidoc::X509Cert "jbyteArray"
+%typemap(jstype) digidoc::X509Cert, digidoc::X509Cert* "java.security.cert.X509Certificate"
+%typemap(jni) std::vector<unsigned char>, digidoc::X509Cert, digidoc::X509Cert * "jbyteArray"
 %typemap(javain) std::vector<unsigned char>, digidoc::X509Cert "$javainput"
 %typemap(javaout) std::vector<unsigned char> {
     return $jnicall;
   }
-%typemap(javaout, throws="java.security.cert.CertificateException, java.io.IOException") digidoc::X509Cert {
+%typemap(javaout, throws="java.security.cert.CertificateException, java.io.IOException") digidoc::X509Cert, digidoc::X509Cert * {
     byte[] der = $jnicall;
     java.security.cert.CertificateFactory cf = java.security.cert.CertificateFactory.getInstance("X509");
     try (java.io.ByteArrayInputStream is = new java.io.ByteArrayInputStream(der)) {
@@ -120,7 +122,7 @@ static std::vector<unsigned char>* SWIG_JavaArrayToVectorUnsignedChar(JNIEnv *je
 
 #elif defined(SWIGCSHARP)
 %typemap(cstype) std::vector<unsigned char> "byte[]"
-%typemap(cstype) digidoc::X509Cert "System.Security.Cryptography.X509Certificates.X509Certificate2"
+%typemap(cstype) digidoc::X509Cert, digidoc::X509Cert* "System.Security.Cryptography.X509Certificates.X509Certificate2"
 %typemap(csin, pre= "    global::System.IntPtr cPtr$csinput = digidocPINVOKE.ByteVector_to($csinput, $csinput.Length);
     var handleRef$csinput = new global::System.Runtime.InteropServices.HandleRef($csinput, cPtr$csinput);"
 ) std::vector<unsigned char> "handleRef$csinput"
@@ -132,6 +134,14 @@ static std::vector<unsigned char>* SWIG_JavaArrayToVectorUnsignedChar(JNIEnv *je
     global::System.IntPtr cPtr = $imcall;$excode
     return new System.Security.Cryptography.X509Certificates.X509Certificate2($modulePINVOKE.To_ByteArray(cPtr));
   }
+%typemap(csvarout, excode=SWIGEXCODE2) digidoc::X509Cert * %{
+    get {
+      global::System.IntPtr cPtr = $imcall;$excode
+      byte[] der = new byte[$modulePINVOKE.ByteVector_size(cPtr)];
+      global::System.Runtime.InteropServices.Marshal.Copy($modulePINVOKE.ByteVector_data(cPtr), der, 0, der.Length);
+      $modulePINVOKE.ByteVector_free(cPtr);
+      return new System.Security.Cryptography.X509Certificates.X509Certificate2(der);
+    } %}
 %typemap(out) std::vector<unsigned char> %{  $result = new std::vector<unsigned char>(std::move($1)); %}
 %typemap(out) digidoc::X509Cert %{  $result = new std::vector<unsigned char>($1.operator std::vector<unsigned char>()); %}
 
@@ -154,6 +164,10 @@ static std::vector<unsigned char>* SWIG_JavaArrayToVectorUnsignedChar(JNIEnv *je
     std::vector<unsigned char> temp = $1;
     $result = PyBytes_FromStringAndSize((const char*)temp.data(), temp.size());
 }
+%typemap(out) digidoc::X509Cert * {
+    std::vector<unsigned char> temp = *$1;
+    $result = PyBytes_FromStringAndSize((const char*)temp.data(), temp.size());
+}
 #endif
 %typemap(freearg) std::vector<unsigned char>
 %{ delete $1; %}
@@ -205,6 +219,9 @@ static std::vector<unsigned char>* SWIG_JavaArrayToVectorUnsignedChar(JNIEnv *je
 %newobject digidoc::Container::open;
 %newobject digidoc::Container::create;
 
+%immutable digidoc::TSAInfo::cert;
+%immutable digidoc::TSAInfo::time;
+
 %feature("director") digidoc::ContainerOpenCB;
 
 %typemap(javacode) digidoc::Conf %{
@@ -262,6 +279,7 @@ def transfer(self):
 %template(StringMap) std::map<std::string,std::string>;
 %template(DataFiles) std::vector<digidoc::DataFile*>;
 %template(Signatures) std::vector<digidoc::Signature*>;
+%template(TSAInfos) std::vector<digidoc::TSAInfo>;
 
 %extend digidoc::Container {
     static digidoc::Container* open(const std::string &path, digidoc::ContainerOpenCB *cb)

src/Signature.cpp

@@ -230,6 +230,11 @@ X509Cert Signature::ArchiveTimeStampCertificate() const { return X509Cert(); }
  */
 string Signature::ArchiveTimeStampTime() const { return {}; }
 
+/**
+ * Returns signature Archive TimeStampTokens.
+ */
+vector<TSAInfo> Signature::ArchiveTimeStamps() const { return {}; }
+
 struct Signature::Validator::Private
 {
     Status result = Valid;

src/Signature.h

@@ -21,13 +21,18 @@
 
 #include "Exception.h"
 
-#include <string>
-#include <vector>
+#include "crypto/X509Cert.h"
 
 namespace digidoc
 {
     class Signer;
     class X509Cert;
+
+    struct TSAInfo {
+        X509Cert cert;
+        std::string time;
+    };
+
     class DIGIDOCPP_EXPORT Signature
     {
       public:
@@ -86,18 +91,18 @@ namespace digidoc
           virtual std::string countryName() const;
           virtual std::vector<std::string> signerRoles() const;
 
-          //TM profile properties
+          // TM profile properties
           virtual std::string OCSPProducedAt() const;
           virtual X509Cert OCSPCertificate() const;
           DIGIDOCPP_DEPRECATED virtual std::vector<unsigned char> OCSPNonce() const;
 
-          //TS profile properties
+          // TS profile properties
           virtual X509Cert TimeStampCertificate() const;
           virtual std::string TimeStampTime() const;
 
-          //TSA profile properties
-          virtual X509Cert ArchiveTimeStampCertificate() const;
-          virtual std::string ArchiveTimeStampTime() const;
+          // TSA profile properties
+          DIGIDOCPP_DEPRECATED virtual X509Cert ArchiveTimeStampCertificate() const;
+          DIGIDOCPP_DEPRECATED virtual std::string ArchiveTimeStampTime() const;
 
           // Xades properties
           virtual std::string streetAddress() const;
@@ -114,6 +119,9 @@ namespace digidoc
           // DSig properties
           virtual void extendSignatureProfile(Signer *signer);
 
+          //TSA profile properties
+          virtual std::vector<TSAInfo> ArchiveTimeStamps() const;
+
       protected:
           Signature();
 

src/SignatureTST.cpp

@@ -91,6 +91,74 @@ SignatureTST::SignatureTST(ASiC_S *asicSDoc, Signer *signer)
 
 SignatureTST::~SignatureTST() = default;
 
+std::vector<TSAInfo> SignatureTST::ArchiveTimeStamps() const
+{
+    std::vector<TSAInfo> result;
+    for(auto i = metadata.cbegin() + 1; i != metadata.cend(); ++i)
+    {
+        if(i->mime != "application/vnd.etsi.timestamp-token")
+            continue;
+        TS ts((const unsigned char*)i->data.data(), i->data.size());
+        result.push_back({ts.cert(), util::date::to_string(ts.time())});
+    }
+    return result;
+}
+
+void SignatureTST::extendSignatureProfile(Signer *signer)
+{
+
+    string tstName = "META-INF/timestamp001.tst";
+    for(size_t i = 1;
+         any_of(metadata, [&tstName](const auto &f) { return f.name == tstName; });
+         tstName = Log::format("META-INF/timestamp%03zu.tst", ++i));
+
+    auto doc = XMLDocument::create("ASiCManifest", ASiContainer::ASIC_NS, "asic");
+    auto ref = doc + "SigReference";
+    ref.setProperty("MimeType", "application/vnd.etsi.timestamp-token");
+    ref.setProperty("URI", tstName);
+
+    auto addRef = [&doc](const string &name, string_view mime, bool root, const Digest &digest) {
+        auto ref = doc + "DataObjectReference";
+        ref.setProperty("MimeType", mime);
+        ref.setProperty("URI", util::File::toUriPath(name));
+        if(root)
+            ref.setProperty("Rootfile", "true");
+        auto method = ref + DigestMethod;
+        method.setNS(method.addNS(DSIG_NS, "ds"));
+        method.setProperty("Algorithm", digest.uri());
+        auto value = ref + DigestValue;
+        value.setNS(value.addNS(DSIG_NS, "ds"));
+        value = digest.result();
+    };
+
+    DataFile *file = asicSDoc->dataFiles().front();
+    Digest digest;
+    static_cast<DataFilePrivate*>(file)->digest(digest);
+    addRef(file->fileName(), file->mediaType(), false, digest);
+    for(auto &data: metadata)
+    {
+        if(data.name == "META-INF/ASiCArchiveManifest.xml")
+        {
+            string mfsName = "META-INF/ASiCArchiveManifest001.xml";
+            for(size_t i = 0;
+                 any_of(metadata, [&mfsName](const auto &f) { return f.name == mfsName; });
+                 mfsName = Log::format("META-INF/ASiCArchiveManifest%03zu.xml", ++i));
+            data.name = mfsName;
+            data.root = true;
+        }
+        addRef(data.name, data.mime, data.root, data.digest());
+    }
+
+    string data;
+    doc.save([&data](const char *buf, size_t size) {
+        data.append(buf, size);
+        return size;
+    }, true);
+    metadata.push_back({"META-INF/ASiCArchiveManifest.xml", "text/xml", std::move(data)});
+    vector<unsigned char> der = TS(metadata.back().digest(), signer->userAgent());
+    metadata.push_back({tstName, "application/vnd.etsi.timestamp-token", {der.cbegin(), der.cend()}});
+}
+
 X509Cert SignatureTST::TimeStampCertificate() const
 {
     return timestampToken->cert();

src/SignatureTST.h

@@ -50,10 +50,14 @@ class SignatureTST final: public Signature
     void validate() const final;
     std::vector<unsigned char> dataToSign() const final;
     void setSignatureValue(const std::vector<unsigned char> &signatureValue) final;
+    void extendSignatureProfile(Signer *signer) final;
 
     // Xades properties
     std::string profile() const final;
 
+    //TSA profile properties
+    std::vector<TSAInfo> ArchiveTimeStamps() const;
+
     void save(const ZipSerialize &s) const;
 
 private:

src/digidoc-tool.cpp

@@ -688,15 +688,69 @@ static int open(int argc, char* argv[])
             << "    OCSP Responder: " << s->OCSPCertificate() << endl
             << "    Message imprint (" << msgImprint.size() << "): " << msgImprint << endl
             << "    TS: " << s->TimeStampCertificate() << endl
-            << "    TS time: " << s->TimeStampTime() << endl
-            << "    TSA: " << s->ArchiveTimeStampCertificate() << endl
-            << "    TSA time: " << s->ArchiveTimeStampTime() << endl;
+            << "    TS time: " << s->TimeStampTime() << endl;
+        for(const auto &tsaInfo: s->ArchiveTimeStamps())
+        {
+            cout
+                << "    TSA: " << tsaInfo.cert << '\n'
+                << "    TSA time: " << tsaInfo.time << '\n';
+        }
     }
     if(returnCode == EXIT_SUCCESS && !extractPath.empty())
         return extractFiles();
     return returnCode;
 }
 
+/**
+ * Extend signatures in container.
+ *
+ * @param argc number of command line arguments.
+ * @param argv command line arguments.
+ * @return EXIT_FAILURE (1) - failure, EXIT_SUCCESS (0) - success
+ */
+static int extend(int argc, char *argv[])
+{
+    vector<unsigned int> signatures;
+    bool dontValidate = false;
+    string path, profile;
+    for(int i = 2; i < argc; i++)
+    {
+        string_view arg(argv[i]);
+        if(value v{arg, "--profile="})
+            profile = v;
+        else if(value v{arg, "--signature="})
+            signatures.push_back(unsigned(atoi(v.data())));
+        else if(arg == "--dontValidate")
+            dontValidate = true;
+        else
+            path = arg;
+    }
+
+    if(path.empty())
+        return printUsage(argv[0]);
+
+    unique_ptr<Container> doc;
+    try {
+        doc = Container::openPtr(path);
+    } catch(const Exception &e) {
+        cout << "Failed to parse container" << endl;
+        cout << "  Exception:" << endl << e;
+        return EXIT_FAILURE;
+    }
+
+    for(unsigned int i : signatures)
+    {
+        cout << "  Extending signature " << i << " to " << profile << endl;
+        Signature *s = doc->signatures().at(i);
+        s->extendSignatureProfile(profile);
+        if(!dontValidate)
+            validateSignature(s);
+    }
+
+    doc->save();
+    return EXIT_SUCCESS;
+}
+
 /**
  * Remove items from container.
  *
@@ -1050,6 +1104,8 @@ int main(int argc, char *argv[]) try
         return remove(argc, argv);
     if(command == "sign")
         return sign(*conf, argv[0]);
+    if(command == "extend")
+        return extend(argc, argv);
     if(command == "websign")
         return websign(*conf, argv[0]);
     if(command == "tsl")